Hull and East Riding employers · evidence from work devices
A laptop handed back in good order is worth a second look. Windows keeps records of its own, and so do the sync clients; a tidy-up does not reach them. An inbox rule pushing copies to a private address. A memory stick plugged in at 22:40 on a Friday. A Downloads folder emptied on the morning of the exit meeting. We take the machine out of use, image it to evidential standard, and write up what it shows for HR and your solicitor.
Ring us, in confidence
0800 6890668
| What is in play | What it puts on you | How we work within it |
|---|---|---|
| Data Protection Act 2018 and UK GDPR | Owning the device gives you no lawful basis on its own. Choose one — usually legitimate interests — then run the balancing test and record it before work starts | We scope the examination to the allegation we were given, and stop there |
| ICO guidance on monitoring workers, October 2023 | Transparency is the default, and a DPIA where the risk is high | Your policies get read before the disk does, and we say plainly when a DPIA is needed |
| Covert examination | Justifiable in rare cases only — a suspicion of crime, or serious misconduct — and no step taken until senior management has signed it off | No imaging and no reading until that sign-off is in writing |
| The ACAS standard | A disciplinary decision has to rest on a fair, proportionate enquiry | The findings are reported as they stand, whoever they happen to help |
| Weight at tribunal | Evidence is only as good as the method that produced it | A chain-of-custody log that strengthens the case rather than handing the other side an opening |
It begins with a conversation in confidence, and there is no charge for it. Three answers shape the rest: what happened, how far it reaches — the machines, the accounts — and what the evidence has to prove. Between them they fix the scope. The scope fixes the one written price, and you have that before any device is touched.
Most evidence disappears inside a fortnight, and hardly ever deliberately. IT rebuilds the laptop ready for a new starter. The drive ends up in the spares cupboard. A manager has a quick look for himself. An early write-blocked image beats all three to it.
From then on the copy does the work and the original is left alone. Every removable drive is listed, with when it was plugged in and for how long. So is anything uploaded to a private cloud account or sent as a webmail attachment, anything deleted, and any sign a wiping tool has run. One timeline carries the lot.
The report is written to be read by a solicitor, an HR panel or a tribunal, not by an engineer. It measures what we did against the ICO's guidance on monitoring workers, and against the fair enquiry ACAS expects. If the matter later goes to the police, the document stands as it is.
A report nobody can test is worth little. So the bundle carries the working with it: every exhibit, the images it was read from, a log of each handover, the hash of everything, and what was written down at the time. The other side's expert can repeat it and land where we did.
The one number we will quote: a 2013 Symantec study with the Ponemon Institute found that roughly half of those who had recently changed employer admitted keeping confidential material from the old job. Most of what has appeared since comes from firms with something to sell, and the figures do not agree with one another. Our own experience is duller than any of it — an employer who comes to us naming what they believe was taken, rather than uneasy in general, is usually proved right by the artefacts.
A Bridlington employer brought in a rival's pitch deck and not much else. The timing decided it: the last upload ran twenty days before the resignation letter. On the company's own laptop, the files were pulled together into a single folder, then a personal cloud account was opened and the upload followed — in that order. The matter closed on undertakings.
Owning it decides almost nothing. There has to be a lawful basis, and staff must already have been told that work devices get checked — an acceptable-use policy is what does that job. Where nobody was told, expect the point to be fought. Silent searches are kept back for suspected crime, and a director has to authorise one.
Almost never, and not as routine practice. The ICO's 2023 guidance on monitoring workers reserves it for exceptional circumstances such as suspected crime or gross misconduct. Even then it expects senior management to authorise it, a DPIA, a narrow scope, and the reasoning written down.
Preserve, before anything else happens. Power the machine off, lock it away, and leave the mailbox and cloud accounts running rather than disabling them. Nobody opens a folder until a forensic copy exists. An honest look round the disk rewrites the timestamps that would have shown what left.
How you got there counts for as much as what you found. A damaging finding stops being damaging once the route to it can be picked apart. A screenshot is worth something only where a lawful basis stood behind it, the search stayed within the suspicion that prompted it, and the handling was logged throughout.
A workplace device imaged early and handled properly is far harder to argue with than one examined in a hurry once notice is out. Log a job. The first look costs nothing, and what you tell us stays private.